CVE-2022-40922 LIEF vulnerable to denial of service through segmentation fault
Attackers can cause a denial of service via segmentation fault by providing a crafted MachO file to the LIEF library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-40922?
CVE-2022-40922 is a medium-severity denial of service vulnerability in n/a, published on 3 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.
Which versions are affected by CVE-2022-40922?
3 open source packages ship an affected version, including lief. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lief PyPI | All versions | 0.12.2 |
lief PyPI | All versions | 0.12.2 |
lief PyPI | All versions | 0.12.2 |
Products include Lief-Project Lief.
How do I fix CVE-2022-40922?
Upgrade lief to 0.12.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-40922 being exploited?
There is no known exploitation of CVE-2022-40922 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-32297 LIEF heap-buffer-overflow
- CVE-2022-38306 LIEF vulnerable to heap based buffer overflow
- CVE-2022-38495 LIEF vulnerable to heap based buffer overflow via print_binary function
- CVE-2022-43171 LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind
- CVE-2022-40923 LIEF vulnerable to denial of service through segmentation fault
Sources
Also known as GHSA-38hf-c37x-32hv, PYSEC-2022-43138.